ESA Delay in alerting
Please check if ESA aggregation falling behind using 000032858 - How to check if Event Stream Analysis (ESA) is falling behind concentrators in RSA Secur...
If Sessions behind is high, try https://community.rsa.com/docs/DOC-45974 to real-time alerts.
Glad to hear that problem solved now.
Generally, the rules which holds huge memory with more time window would cause ESA slowness or crash. Please try to use best practices to fine-tune rules. RSA Security Analytics Alerting using ESA Guide for Version 10.6.4